Reading Time: 10 minutes

API governance is often accompanied with a sense of burden as development teams visualize process overheads, review cycles, and long running negotiations. On the other hand, compliance issues with APIs are quickly emerging as a top concern for most software engineering leaders. 

By 2025, fewer than 50% of enterprise APIs will be managed as explosive growth of APIs surpasses the in-built security capabilities of most API management tools. Every unmanaged and unsecured API is a potential vulnerability that could create a multimillion dollar security incident or a security breach headline. Is there a way to avoid such aftermath without treating governance as a necessary evil?

As part of operating in a multi-cloud world across diverse platforms and vendors, IT leaders are investing in four distinct pillars: 

  • Universal visibility and access to APIs
  • High performant and versatile gateways
  • Consistency in security and governance
  • Creating vibrant API ecosystems

Anypoint API Governance 

MuleSoft is introducing Anypoint API Governance to help IT teams maintain consistent quality and adhere to internal standards and industry regulations across all APIs without adding overheads and review cycles to development teams. Our vision with this product is to shift left with governance and to make it frictionless for developers to adopt the governance standards. In this blog post, we will explore how API Governance operationalizes design-time governance and how API Manager provides a unified control plane that ensures consistent security across runtime. 

Ensuring design-time conformance

Design-time governance is growing as a major concern. With exponential adoption of APIs across most organizations, IT leaders need to ensure each specification that involves sensitive information adheres to government regulations, industry standards, or internal best practices to avoid compliance incidents or inefficiencies. 

Traditionally, architects with governance responsibilities in IT teams operationalized governance using manual or hybrid processes and struggled with enforcement and inconsistencies. With API sprawl and rapid development cycles, they are always pressed on resources inevitably bloating their processes and delaying delivery.

Using Anypoint API Governance, central IT teams can leverage out-of-the-box rulesets provided by MuleSoft or create custom rulesets to avoid managing standards in siloed documents. A ruleset is a collection of rules that can be applied over the metadata extracted from any REST API definition. These rules are extensible and based on open standards (W3C, OPA)

Single or multiple rulesets can be used to create a profile, which is a collection of rules that can resemble a governance standard. A profile can be used to define the set of rules a given group of APIs must adhere to. IT teams can create multiple profiles to customize the governance standards per use case across the enterprise. 

Architects can filter and group the APIs based on metadata (tags, categories, etc.). Profiles created are dynamic, which automatically enforces standards across every new API added to Anypoint Exchange that matches the profile criteria. 

latest report
Learn why we are the Leaders in API management and iPaaS
Read reports

IT teams also have a centralized console to comprehensively observe the conformance of APIs to the enterprise specific standards. They can flag development teams directly from the console on violations and suggested remediations 

Avoiding overheads to development teams 

Development teams have traditionally added review steps to their lifecycles and buffers to their delivery timelines. The reviews often lack transparency and proper documentation, making it challenging to keep track of continuously evolving standards. Often this step occurs in the later stages of the development lifecycle, accounting for uncertainties, project delays or reviews falling through the cracks that require breaking changes to production. 

Anypoint API Governance makes governance seamless for development teams to adopt. Developers can self-service standards by accessing the existing profiles from a centralized repository in Anypoint Exchange. These profiles can be accessed as dependencies in API Designer during development. 

If an API does not conform with existing compliance requirements, architects from central IT teams can notify developers via email from the API Governance console. Upon notification, developers can check for any conformance issues in API Designer in real-time and address them, which removes the necessity for additional overheads. 

If an API is created outside Anypoint Platform, developers can automatically catalog these specifications using the updated Anypoint Platform CLI to upload the specification to Anypoint Exchange. API Governance automatically verifies conformance for every asset in Anypoint Exchange. 

Consistent security with a single control plane

Lastly, services owned by different teams require consistent security policies. In the multi-cloud era, managing services across different consoles complicates operations and creates potential security vulnerabilities. IT leaders need to invest in service discovery and manage all their APIs with consistent policies. With the updated API Manager, Anypoint Platform provides a single control plane to extend the control and security policies to every service in your environment. This creates consistency in how service traffic is maintained and simplicity for IT teams in governing all services from a single control plane 

Let’s see it in action

At MuleSoft Transform 2021, we announced our vision for Universal API management on Anypoint Platform and how Anypoint API Governance advances our vision. At TrailblazerDX, we outlined our new products (including the API Governance) that power Universal API management on Anypoint Platform. 

See the full list of products and capabilities that enablement Universal API Management on Anypoint Platform:

We’re excited to see these products in the hands of our community of developers, product managers, and architects. We look forward to how you will use them to enable your composable enterprise.

If you want to see the API Governance in action, check out our platform page. We are excited for you to try the product and use it to avoid security and compliance issues while operating in hybrid/multi cloud environments. Check out our developer tutorials to get started quickly with Universal API management on Anypoint Platform. If you missed MuleSoft Transform or TrailblazerDX, you can now watch the sessions on demand. Make sure to register for MuleSoft CONNECT to catch these products in action! 

Series Navigation<< Build modern apps and architectures with MuleSoft’s Anypoint Flex Gateway